EDR is not enough without an operating model
Deploying an Endpoint Detection and Response (EDR) tool is step one. Running it effectively is the hard part. Without an operating model — defined triage workflows, escalation paths, tuning processes, and response authority — the tool generates noise instead of protection.
The most common symptom: hundreds of alerts per day, most of which are false positives, all of which are either ignored or closed without investigation. Meanwhile, the real threat sits in the queue at position 847, waiting.
Alert fatigue is a design problem
Alert fatigue is not caused by too many threats. It is caused by poor tuning and no triage workflow. A well-tuned EDR generates fewer, higher-quality alerts. A well-designed triage workflow ensures every alert gets the right level of attention based on severity and context.
- Define severity levels with clear criteria (not just vendor defaults)
- Create triage playbooks for each alert category
- Establish time-to-triage targets: critical alerts within 15 minutes, high within 1 hour
- Track and tune false positive rates — aim to reduce them by 30-50% in the first quarter
Ownership and authority
Define who looks at the alerts and who has the authority to take action. Can the security analyst isolate a device at 2 AM on a Sunday if it exhibits ransomware behaviour? Can they disable an executive's account? These decisions need to be made in advance, not during an incident.
Document containment authority in writing. Get sign-off from leadership. Without pre-approved authority, every containment action becomes a political decision during a crisis.
Evidence capture and reporting
Every closed alert ticket should include a note explaining why it was closed: false positive, blocked by policy, remediated, escalated, or accepted risk. This creates the audit trail that proves the operating model is functioning and provides the data needed for continuous tuning.
Report monthly on: total alerts, alerts by severity, mean time to triage, mean time to contain, false positive rate, and tuning actions taken. These metrics prove the EDR investment is delivering value.